Ermetic Researchers Find Cross-site Request Forgery Flaw in Azure Cloud Services

Researchers from Ermetic have detailed their findings of a cross-site request forgery (CSRF) vulnerability affecting Azure cloud services. The flaw, dubbed EmojiDeploy, can be exploited to achieve remote code execution. The vulnerabilities are due to a series of misconfigurations and bypasses in the Kudu back-end source control management tool. Microsoft was alerted to the issues in October 2022 and addressed them in early December.

Note

• This item, and the similar Server-side Request Forgery (SSRF) vulnerability found by Orca in Azure, point out 3 key issues: (1) Cross-site Request Forgery was on the OWASP Top 10 for many years, Server-Side Request Forgery is on the list for 2022. I’d like to hear some lessons learned from Microsoft about why these were in Azure code when so many tools find them easily. (2) Azure was patched when the patches were ready – Microsoft did not have to wait until the monthly Vulnerability Tuesday. (3) We still see external parties (good guys with responsibly disclosed vulnerabilities and bad guys exploiting zero days) being credited on the majority of patches that come out in Windows. This all adds up to faster patching is still important and the monthly patch cycle is like using a 4800 baud modem for IT ops hygiene when the bad guys are on gigabit connections.

Read more in

• EmojiDeploy: Smile! Your Azure web service just got RCE’d ._.
• Cross-Origin Resource Sharing (CORS)
• How Orca Found Server-Side Request Forgery (SSRF) Vulnerabilities in Four Different Azure Services
• Principle of least privilege (PoLP)
• Oracle Server Side Request Forgery (SSRF) Metadata